feat: Foundation — auth system, 9 migrations, React frontend

Backend:
- Express server with JWT httpOnly cookie auth
- POST /api/auth/register, /api/auth/login, /api/auth/logout, GET /api/auth/me
- bcrypt 12 rounds, generic 401 errors (no email/password field disclosure)
- Auth middleware protects all /api/* routes except register/login
- pg Pool database connection

Frontend (React + Vite + TailwindCSS + shadcn/ui):
- AuthContext with session restore on page load via /api/auth/me
- ProtectedRoute redirects unauthenticated users to /login
- LoginPage, RegisterPage — Hebrew RTL layout (dir=rtl), inline validation
- DashboardPage placeholder
- shadcn/ui components: Button, Input, Label, Card

Database:
- 9 migrations (001-009): extensions, users, events, vendors, guests,
  bookings, invitations, vendor_ratings, organizer_preferences
- pg_trgm for fuzzy Hebrew search, GIN indexes on style_tags
- Phase 2+3 fields included: source, payment_status, contract_value,
  vendor ratings 6-dimension, organizer preferences
- Idempotent migration runner with schema_migrations tracking table

Infrastructure:
- Dockerfile (multi-stage: build React → production node:20-alpine)
- docker-compose.yml with PostgreSQL healthcheck, expose not ports
- Migrations run automatically on container start

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/seed.js

@@ -0,0 +1,39 @@
+require('dotenv').config();
+const fs = require('fs');
+const path = require('path');
+const bcrypt = require('bcrypt');
+const { Pool } = require('pg');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL });
+
+async function seed() {
+  const hash = await bcrypt.hash('Password123!', 12);
+
+  let sql = fs.readFileSync(
+    path.join(__dirname, '..', 'seeds', '001_seed_test_data.sql'),
+    'utf8'
+  );
+
+  // Replace placeholder hash with real bcrypt hash
+  sql = sql.replace(/\$2b\$10\$REPLACE_WITH_REAL_HASH/g, hash);
+
+  try {
+    await pool.query(sql);
+    console.log('✅ Seed data inserted');
+  } catch (err) {
+    // Ignore duplicate key errors (idempotent re-run)
+    if (err.code === '23505') {
+      console.log('ℹ️  Seed data already present, skipping');
+    } else {
+      console.error('❌ Seed error:', err.message);
+      process.exit(1);
+    }
+  }
+
+  await pool.end();
+}
+
+seed().catch(err => {
+  console.error('Seed error:', err);
+  process.exit(1);
+});